PT-2024-5937 · Haproxy+2 · Haproxy+2

Published 2024-09-04 · Updated 2025-09-11 · CVE-2024-45506

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions HAProxy versions 2.9.x through 2.9.9 HAProxy versions 3.0.x through 3.0.3 HAProxy versions 3.1.x through 3.1-dev6

Description The issue is related to a remote denial of service vulnerability in HAProxy, which can be exploited under certain conditions. This vulnerability has been exploited in the wild. The vulnerability is caused by an endless loop when handling HTTP/2 zero-copy forwarding, which can lead to service disruptions and system crashing.

Recommendations For HAProxy versions 2.9.x through 2.9.9, update to version 2.9.10 or later. For HAProxy versions 3.0.x through 3.0.3, update to version 3.0.4 or later. For HAProxy versions 3.1.x through 3.1-dev6, update to a version later than 3.1-dev6. As a temporary workaround, consider disabling HTTP/2 zero-copy forwarding until a patch is available.

Fix

DoS

Infinite Loop

Improper Resource Release

Weakness Enumeration

CWE-835

CWE-404

Related Identifiers

AZL-48668

BDU:2024-06744

BIT-HAPROXY-2024-45506

CVE-2024-45506

OESA-2024-2130

OPENSUSE-SU-2024:14307-1

Affected Products

Astra Linux

Haproxy

Red Os

References · 49

• https://osv.dev/vulnerability/OESA-2024-2130 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-45506 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-45506 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/711485 · Security Note
• https://ubuntu.com/security/CVE-2024-45506 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-haproxy-2024-45506 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45506 · Security Note
• https://bdu.fstec.ru/vul/2024-06744 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/AZL-48668 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-45506 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45506 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-45506 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14307-1 · Vendor Advisory
• https://t.me/cvedetector/4794 · Telegram Post